Risk-based internal auditing and its implementation in Malta

Abstract

Purpose: The study sets out to evaluate the current application or, where relevant, the potential applicability of risk-based internal auditing within different Maltese internal audit units. In order to attain this objective, the structure and types of Maltese internal audit units were asserted and the state of risk-based internal auditing and its implementation were evaluated by looking at the organisations' perspectives of risk, the current systems in use and the advantages or disadvantages of the current systems. Design: The objective was achieved through a series of personal semi structured interviews with 13 internal audit executives representing the majority of known Maltese internal audit units. Findings: The study revealed that the most common type of internal audit units were in housed though limitedly resourced within the organisation. On average organisations were seen to have a risk maturity of risk defined and it was noted that risk-based internal auditing was widely used by most organisations. The method was found to be effective, allowed for a good relationship with management and was considered efficient and simple to operate. Value: Risk-based internal auditing contributes to the fruitful development of the internal audit units. This study recommends that management be further educated on risk and that internal auditing and risk management be included in University courses. It shows that internal auditors should always be alert of not compromising independence where organisations are not risk mature and identifies the need for standards and guidelines. It also suggests that the appreciation of internal audit units should be widened so that its use is promoted within companies of a certain size or importance.